Quick answer

Cyber libel is libel committed through a computer system or similar information-and-communications technology—for example, through a social-media post, website, blog, email, or online message sent to another person. A case normally requires a defamatory imputation, identification of the offended person, publication to at least one third person, malice, and proof that the accused was responsible for the online publication.

To file, preserve the original electronic evidence immediately and submit a sworn complaint with supporting evidence to the prosecutor’s office that has proper territorial authority. To defend, do not ignore a prosecutor’s subpoena: obtain the complete complaint, preserve your own records, and submit a sworn, evidence-backed counter-affidavit within the stated deadline.

Act quickly. The Supreme Court has confirmed that cyber libel prescribes in one year from discovery of the alleged offense by the offended party, the authorities, or their agents, subject to interruption under Article 91 of the Revised Penal Code. When discovery occurred is a factual issue that may require evidence; it is not automatically presumed to be the date the material was posted. (Supreme Court E-Library)

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the prohibited publication is made through a computer system or similar means.

In general, the prosecution must prove all of the following beyond reasonable doubt:

Defamatory imputation. The material imputes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person to contempt.
Identification. The complainant is named or is otherwise identifiable from the words, images, surrounding circumstances, or information known to the audience. It is not always necessary to use the person’s full name.
Publication. Someone other than the author and the person defamed received, read, heard, or saw the material. A purely private message sent only to the person concerned ordinarily lacks this element, although forwarding it to others may change the analysis.
Malice. As a general rule, a defamatory publication is presumed malicious even if the statement is true, unless it falls within a recognized privileged communication. Different rules apply to privileged communications and speech concerning public officers, public figures, or matters of public interest.
Use of a computer system or ICT. The publication was made online or through covered technology.
Responsibility of the accused. The evidence must reliably connect the respondent to the account, device, message, or publication. A profile name or screenshot alone may not conclusively establish authorship.

The statement is assessed as a whole and in its actual context. Courts consider the language used, audience, accompanying images, conversational setting, and ordinary meaning—not merely an isolated word or sentence.

Who may be liable?

The Supreme Court upheld cyber-libel liability as applied to the original author of the online post. It struck down its application to people who merely receive a post and react to it, such as by an ordinary “like,” because imposing liability on those passive reactions would improperly expand the offense. See Disini v. Secretary of Justice. (Supreme Court E-Library)

That does not make every form of sharing risk-free. A person who republishes material while adding a new defamatory accusation, adopts the accusation as their own, or independently sends it to a new audience may be treated differently. Liability depends on the precise act, wording, intent, and evidence.

Account owners are not automatically guilty merely because a post appeared under their name. The prosecution must prove identity and authorship beyond reasonable doubt at trial. Evidence of hacking, impersonation, shared account access, loss of a device, fabricated screenshots, or unauthorized posting can therefore be important.

Opinion, criticism, and public-interest speech

Calling a statement an “opinion” does not automatically protect it. Courts examine whether it is genuinely comment or rhetoric, or whether it reasonably asserts a verifiable and defamatory fact. “In my opinion, X stole the money” may still communicate a factual accusation of theft.

Speech about public officers, public figures, and legitimate matters of public concern receives stronger constitutional protection. For criminal liability in such cases, the prosecution must prove actual malice: that the accused knew the defamatory statement was false or published it with reckless disregard for whether it was true. Mere error, inaccuracy, or negligence is not by itself actual malice. Reckless disregard is evaluated from the evidence and circumstances of the particular case. (lawphil.net)

Fair criticism of official conduct is not automatically libelous. Personal attacks unrelated to public duties, knowingly false accusations, fabricated evidence, or publication despite serious doubts about truth may fall outside that protection.

Truth and privileged communications

Truth is important, but in ordinary private-person cases it should not be treated as a stand-alone guarantee of acquittal. Article 361 of the Revised Penal Code generally requires proof of the truth of the imputation and that the publication was made with good motives and justifiable ends, subject to the article’s rules and exceptions.

Article 354 recognizes privileged communications, including:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without comments or remarks, of qualifying official proceedings or acts of public officers.

A qualified privilege generally prevents the ordinary presumption of malice from arising. It does not provide absolute immunity: liability may still follow if the prosecution proves malice in fact. The scope of the privilege depends on the occasion, recipients, relevance, wording, and whether publication went beyond people with a legitimate interest.

Communications made in judicial proceedings may receive broader protection when relevant to the proceeding, but simply uploading pleadings or accusations to social media is not automatically protected.

How to file a cyber-libel complaint

1. Preserve the evidence before contacting the poster

Save more than a cropped screenshot. Preserve, where available:

The entire post, comment, thread, email, or conversation;
The account name, profile page, username, and visible account URL;
The direct URL of the post;
Date and time shown, including the device’s time zone;
Images, audio, video, attachments, hashtags, and edited versions;
Comments, shares, recipients, and other proof that a third person saw it;
Screen recordings showing how the page was reached;
Original downloaded files and their metadata;
Messages identifying the author or acknowledging the post;
Evidence of when and how you first discovered the publication;
Names and contact information of witnesses who personally saw it; and
Evidence of reputational or financial harm, such as cancelled work, client messages, or threats received.

Keep the original files unchanged. Make working copies, record when and how each item was collected, and back them up securely. If a witness captured the material, obtain that witness’s sworn statement rather than relying only on a forwarded image.

A screenshot can be evidence, but authenticity and authorship may be challenged. A lawyer or qualified digital-forensics professional can help preserve metadata, calculate file hashes, document the collection process, or determine whether court-authorized disclosure is needed.

2. Record the discovery date

Write down the exact date, time, and circumstances in which you, law enforcement, or an authorized agent first discovered the publication. Preserve the message, email, report, or witness testimony that proves that date.

This matters because cyber libel currently has a one-year prescriptive period running from discovery. The mere fact that a post was publicly accessible does not create a legal presumption that the complainant discovered it on its posting date. (lawphil.net)

Do not wait until the end of the year. Questions about interruption, the proper office, amendment of a defective complaint, or proof of discovery can jeopardize a late filing.

3. Identify the proper prosecutor’s office

A criminal complaint is generally filed for preliminary investigation with the appropriate Office of the City Prosecutor or Office of the Provincial Prosecutor. Venue for an eventual cybercrime prosecution may lie where:

The offense or any of its elements occurred;
Any part of the computer system used is situated; or
Damage to the natural or juridical person occurred.

The criminal action belongs in the designated cybercrime court with territorial authority, and the first court in which the criminal action is properly filed acquires jurisdiction to the exclusion of other courts. Venue in criminal cases is jurisdictional, so do not assume that the complainant may file anywhere merely because an online post can be viewed nationwide.

Where the author posted, where the complainant was located, where the damage occurred, and where relevant systems were situated may require supporting facts. Obtain venue-specific advice when the parties, devices, or servers are in different cities or countries.

4. Prepare the complaint-affidavit

The complaint-affidavit should state facts based on personal knowledge, in chronological order. It should ordinarily identify:

The complainant and respondent;
The exact defamatory words or material;
The online platform and manner of publication;
Why the words refer to the complainant;
Who saw or received the material;
Facts connecting the respondent to the account or publication;
Why the imputation is false or unlawful;
Facts relevant to malice;
Where the material was posted, received, or caused damage;
The date of discovery; and
The attached evidence and what each exhibit proves.

Attach properly marked copies of the post, URLs, witness affidavits, relevant records, and other evidence. Bring the originals or source devices when instructed. The affidavit must be sworn before an authorized officer.

The DOJ’s filing guidance lists the required investigation form, complaint-affidavit or sworn statement, and supporting evidence. Confirm the current number of copies, filing method, identification requirements, and local intake procedure directly with the receiving prosecutor’s office. See the DOJ’s Filing of Complaint for Preliminary Investigation page and official forms.

5. Consider law-enforcement assistance

The complainant may seek assistance from the National Bureau of Investigation Cybercrime Division or the Philippine National Police Anti-Cybercrime Group, particularly when authorship is concealed, account or subscriber information must be traced, or volatile electronic evidence requires preservation.

Private parties should not attempt to access another person’s account or device without authority. Disclosure, preservation, interception, and search of computer data are governed by law and, where applicable, court-issued cybercrime warrants. Filing a report with law enforcement also should not be assumed to preserve every claim or replace timely filing with the proper prosecution office.

6. Participate in the preliminary investigation

The prosecutor does not decide guilt beyond reasonable doubt. Under the 2024 DOJ–National Prosecution Service Rules, the prosecutor determines whether the evidence establishes a prima facie case with reasonable certainty of conviction. The Supreme Court has recognized these rules and the DOJ’s authority to issue them. (lawphil.net)

The respondent will normally be subpoenaed and given the complaint and supporting evidence. The parties may be directed to appear at a preliminary-investigation hearing and submit affidavits and permitted responsive pleadings. Follow the prosecutor’s written order: local arrangements, electronic submission instructions, and case-specific deadlines may differ.

If sufficient evidence is found, an information is filed in the proper Regional Trial Court designated to handle cybercrime cases. If the complaint is dismissed, the available motion for reconsideration or DOJ review, including its deadline and required attachments, should be assessed immediately under the applicable prosecution rules.

How to defend against a cyber-libel complaint

1. Do not ignore the subpoena

Note the actual date and manner of receipt. Obtain complete copies of the complaint, affidavits, screenshots, and exhibits. The subpoena or hearing notice should state when the counter-affidavit is due.

Under the regular preliminary-investigation procedure, the scheduled opportunity to submit a counter-affidavit must generally give the respondent at least the prescribed notice period. Do not assume an extension will be granted. If essential material is missing or more time is genuinely necessary, raise the problem promptly in a written request before the deadline.

Failure to respond may allow the prosecutor to resolve the case using the complainant’s evidence alone. Preliminary investigation is usually the first meaningful opportunity to expose defects in identification, publication, malice, venue, authenticity, or prescription.

2. Preserve—not erase—your records

Keep the device, account records, login notices, original files, drafts, source documents, messages, and backups. Preserve evidence showing:

Who controlled the account;
Whether the account was hacked, impersonated, or shared;
Where the device and account user were located;
The intended and actual recipients;
The factual research or documents relied upon;
The context of the conversation;
Any correction, retraction, apology, or deletion;
Threats, provocation, or preceding communications; and
When the complainant or authorities actually learned of the post.

Do not fabricate, backdate, edit, or coach evidence. Deleting a post does not eliminate copies already held by viewers or platforms and does not undo a completed publication. It may also destroy evidence needed for the defense. Ask counsel how to stop continuing harm while preserving an authenticated copy.

3. Build the defense around the elements

Depending on the evidence, defenses may include:

The words are not defamatory when read in context;
The complainant is not reasonably identifiable;
There was no publication to a third person;
The accused did not author, post, or authorize the material;
The evidence does not authenticate the account or screenshot;
The statement is protected fair comment or nonfactual rhetoric;
The subject is a public officer, public figure, or matter of public interest and actual malice cannot be proved;
The communication is privileged;
The imputation is true and was published with good motives and justifiable ends, where Article 361 applies;
The prosecution was filed in the wrong venue;
The complaint was filed after prescription had run; or
The alleged act occurred before the cyber-libel provision could lawfully apply.

A denial should be specific and supported by records. A bare assertion that an account was “hacked” is weaker than login alerts, device histories, recovery emails, police reports, platform notices, and testimony identifying who had access.

4. Submit a careful counter-affidavit

A counter-affidavit is sworn evidence and can affect later proceedings. It should respond to the accusation and exhibits point by point without unnecessary admissions. Attach authentic supporting documents and affidavits from witnesses with personal knowledge.

Have counsel assess before disclosing passwords, private messages, confidential sources, privileged communications, employer records, or an entire device. A prosecutor’s subpoena is not permission to alter evidence, but it also does not mean every private record should be surrendered without examining relevance and legal protections.

5. Challenge improper access or seizure through counsel

Law-enforcement access to stored computer data may require the appropriate court order under the Rule on Cybercrime Warrants. If a device was seized or data was obtained, counsel should examine:

The particular warrant or legal authority used;
The devices, accounts, places, and data covered;
Compliance with the warrant’s period and return requirements;
Preservation of forensic integrity;
Chain of custody; and
Whether examination exceeded the authority granted.

Do not physically resist a lawful search or attempt to remotely wipe a seized device. Record the circumstances, request copies of available papers, and seek legal advice immediately.

Penalties and civil liability

Traditional written libel is punishable under Article 355, as amended by Republic Act No. 10951, by prisión correccional in its minimum and medium periods, a fine of ₱40,000 to ₱1,200,000, or both, in addition to possible civil liability.

Because cyber libel is committed through ICT, Section 6 of the Cybercrime Prevention Act raises the applicable penalty by one degree. The Supreme Court has held that imprisonment and a fine remain alternative or concurrent penalties, depending on the case. If the court imposes a fine for cyber libel, the current statutory range is ₱40,000 to ₱1,500,000. A fine alone is legally possible, but it is not guaranteed; imprisonment remains available. See People v. Soliman. (Supreme Court E-Library)

A criminal case may also carry civil liability. Under Rule 111, the civil action to recover civil liability arising from the offense is generally deemed instituted with the criminal action unless it is waived, reserved, or filed earlier, subject to the Rules of Court. A separate civil action for defamation may also be affected by a one-year prescriptive period. The appropriate civil route, recoverable damages, and effect of any prior filing require case-specific advice.

Prescription and other critical deadlines

The controlling rule is that cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents. The period is interrupted by the filing of the complaint or information as provided by Article 91 and begins to run again when proceedings terminate without conviction or acquittal, or are unjustifiably stopped for a reason not imputable to the accused.

Important cautions:

Publication and discovery are not necessarily the same date.
There is no automatic presumption that a person discovered a post as soon as it went online.
The claimed discovery date may be tested against messages, comments, reports, witnesses, and other evidence.
A continuing online presence should not be assumed to restart prescription every day.
A later edit, repost, or new publication may raise a separate factual and legal issue.
A demand letter, platform report, barangay proceeding, or private negotiation should not be assumed to interrupt criminal prescription.
A separate civil defamation claim also generally has a one-year period, but its commencement and interruption must be analyzed independently.

Because even a short delay can be decisive, both complainants and respondents should have the timeline reviewed immediately.

Common mistakes to avoid

If you are filing

Submitting only a cropped screenshot without the URL, context, account details, or witness testimony;
Failing to prove that anyone other than you received the material;
Assuming that an offensive or false statement is automatically defamatory;
Naming the account owner without evidence of authorship or control;
Filing in a convenient city without establishing venue;
Treating truth, falsity, malice, and actual malice as interchangeable concepts;
Waiting for a platform response while prescription continues to run;
Editing evidence or repeatedly opening and resaving original files;
Publicly retaliating with accusations that may create a separate case; or
Assuming that deletion or an apology automatically ends criminal liability.

If you are defending

Ignoring the subpoena or missing the counter-affidavit deadline;
Deleting accounts, chats, files, or login records;
Contacting or threatening the complainant or witnesses;
Posting a second attack about the case;
Admitting authorship casually while trying to “explain” the post;
Relying on “freedom of speech” without addressing the legal elements;
Claiming privilege without showing the duty, proper recipients, relevance, and good faith;
Claiming truth without preserving reliable sources;
Assuming that every public employee is automatically a public figure for every subject; or
Assuming that prescription is obvious without proving the discovery timeline.

When legal help is urgent

Consult a Philippine lawyer promptly if:

The one-year period may expire soon;
You have received a prosecutor’s subpoena, resolution, information, warrant, or court notice;
A device or account has been searched, seized, preserved, or subjected to a disclosure request;
The author is anonymous or is using an impersonation account;
The material involves a public official, journalist, election, workplace investigation, or pending court case;
Multiple people reposted or edited the material;
The post contains threats, intimate images, harassment, identity theft, or accusations involving a child;
The parties or computer systems are in different jurisdictions;
You are considering a retraction, settlement, or affidavit of desistance; or
The same facts may involve another offense or an employment, administrative, data-privacy, or civil claim.

An affidavit of desistance does not automatically require prosecutors or courts to dismiss a criminal case. Settlement documents, admissions, apologies, and takedown requests should be reviewed before signing or sending them.

Persons who cannot afford private counsel may ask the Public Attorney’s Office about eligibility. A complainant may approach the proper prosecution office, NBI Cybercrime Division, or PNP Anti-Cybercrime Group for official assistance.

Frequently asked questions

Is a Facebook post automatically cyber libel?

No. The prosecution must still prove every element, including defamatory meaning, identification, publication, malice where required, use of ICT, and the accused’s responsibility for the post.

Can a private chat be cyber libel?

If it was sent only to the person allegedly defamed, publication to a third person may be absent. A group chat, copied email, forwarded message, or message sent to someone else can satisfy publication, depending on the evidence.

Are likes and ordinary reactions criminal?

The Supreme Court ruled that cyber-libel liability cannot be imposed on people who merely receive and react to a post. A person who adds an independent defamatory accusation or republishes material as their own presents a different issue.

Is sharing a post always safe?

No. A bare platform reaction is different from deliberately republishing an accusation with an adopting or defamatory caption. The exact act and added words matter.

Does deleting the post prevent a case?

No. Deletion may limit further circulation but does not erase a publication already completed. Preserve an authentic copy and obtain advice before altering anything relevant.

Is a screenshot enough?

It may help, but it can be challenged. Stronger proof includes the complete page, URL, date and time, account details, original files, metadata, witnesses who saw the post, and evidence connecting the respondent to the account.

What if the accusation is true?

Truth can be a defense in circumstances governed by Article 361, but ordinary private-person cases may also require good motives and justifiable ends. Public-interest and public-figure cases involve additional constitutional standards. The answer depends on the subject, purpose, sources, and manner of publication.

Can I sue an anonymous account?

A complaint may be possible, but identifying the responsible person may require lawful preservation and disclosure procedures. Report the account promptly, preserve all identifiers, and seek help from counsel or a cybercrime law-enforcement unit.

Can the complainant file both criminal and civil cases?

Potentially, but the relationship between the criminal case, the civil liability arising from the offense, and any independent civil action is governed by Rule 111, the Civil Code, prescription rules, and the complainant’s prior filings or reservations.

Does an apology end the case?

Not automatically. It may affect the complainant’s decision, settlement discussions, assessment of circumstances, or eventual penalty, but cyber libel is a public offense prosecuted in the name of the People of the Philippines.

Official sources

This article provides general legal information, not legal advice or an attorney-client relationship. Cyber-libel outcomes depend heavily on the exact words, audience, evidence, dates, venue, and status of the person concerned. Current law and official procedures were checked as of September 22, 2026.